Fixed Web-RDP when a default user is set and no users are logged in.
Ylian Saint-Hilaire committed
Jun 28, 2022 at 15:20 UTC
0637412d1b94c6c175b3057f06ef60f7acae09c2
2 files changed
+15
-7
apprelays.js
+9
-3
@@ -244,6 +244,8 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
244
if (i > 0) { baseurl = req.url.substring(0, i); }
245
if (baseurl.endsWith('/.websocket')) { req.url = baseurl.substring(0, baseurl.length - 11) + ((i < 1) ? '' : req.url.substring(i)); }
246
247
+ //console.log('processWebSocket', obj.tunnelId, req.url);
248
+
249
// Construct the HTTP request and send it out
250
var request = req.method + ' ' + req.url + ' HTTP/' + req.httpVersion + '\r\n';
251
request += 'host: ' + obj.addr + ':' + obj.port + '\r\n';
@@ -287,6 +289,7 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
289
for (var i = 0; i < payload.length; i++) { payload[i] = (payload[i] ^ mask[i % 4]); }
290
291
// Send the frame
292
+ //console.log(obj.tunnelId, '-->', op, payload.length);
293
send(Buffer.concat([header, payload]));
294
});
295
obj.ws.on('close', function () { obj.close(); });
@@ -502,6 +505,7 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
505
const op = buf[0] & 0x0F;
506
const mask = ((buf[1] & 0x80) != 0);
507
var len = buf[1] & 0x7F;
508
+ //console.log(obj.tunnelId, 'fin: ' + fin + ', rsv: ' + rsv + ', op: ' + op + ', len: ' + len);
509
510
// Calculate the total length
511
var payload = null;
@@ -513,16 +517,16 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
517
} else if (len == 126) {
518
// 2 byte length
519
if (buf.length < 4) return;
516
- len = buf.readInt16BE(2);
520
+ len = buf.readUInt16BE(2);
521
if (buf.length < (4 + len)) return; // Insuffisent data
522
payload = buf.slice(4, 4 + len);
523
obj.socketAccumulator = obj.socketAccumulator.substring(4 + len); // Remove data from accumulator
524
} if (len == 127) {
525
// 8 byte length
526
if (buf.length < 10) return;
523
- len = buf.readInt32BE(2);
527
+ len = buf.readUInt32BE(2);
528
if (len > 0) { obj.close(); return; } // This frame is larger than 4 gigabyte, close the connection.
525
- len = buf.readInt32BE(6);
529
+ len = buf.readUInt32BE(6);
530
if (buf.length < (10 + len)) return; // Insuffisent data
531
payload = buf.slice(10, 10 + len);
532
obj.socketAccumulator = obj.socketAccumulator.substring(10 + len); // Remove data from accumulator
@@ -533,6 +537,7 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
537
if ((mask == true) || (rsv == true)) { obj.close(); return; }
538
539
// TODO: If FIN is not set, we need to add support for continue frames
540
+ //console.log(obj.tunnelId, '<--', op, payload ? payload.length : 0);
541
542
// Perform operation
543
switch (op) {
@@ -585,6 +590,7 @@ module.exports.CreateWebRelay = function (parent, db, args, domain) {
590
else if (blockHeaders.indexOf(i) == -1) { obj.res.set(i, header[i]); } // Set the headers if not blocked
591
}
592
obj.res.set('Content-Security-Policy', "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:;"); // Set an "allow all" policy, see if the can restrict this in the future
593
+ obj.res.set('Cache-Control', 'no-cache'); // Tell the browser not to cache the responses since since the relay port can be used for many relays
594
}
595
596
// If there is data, send it
webserver.js
+6
-4
@@ -6072,7 +6072,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6072
obj.app.ws(url + 'mstscrelay.ashx', function (ws, req) {
6073
const domain = getDomain(req);
6074
if (domain == null) { parent.debug('web', 'mstsc: failed checks.'); try { ws.close(); } catch (e) { } return; }
6075
- require('./apprelays.js').CreateMstscRelay(obj, obj.db, ws, req, obj.args, domain);
6075
+ // If no user is logged in and we have a default user, set it now.
6076
+ if ((req.session.userid == null) && (typeof obj.args.user == 'string') && (obj.users['user/' + domain.id + '/' + obj.args.user.toLowerCase()])) { req.session.userid = 'user/' + domain.id + '/' + obj.args.user.toLowerCase(); }
6077
+ try { require('./apprelays.js').CreateMstscRelay(obj, obj.db, ws, req, obj.args, domain); } catch (ex) { console.log(ex); }
6078
});
6079
}
6080
@@ -6082,9 +6084,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6084
obj.app.ws(url + 'sshrelay.ashx', function (ws, req) {
6085
const domain = getDomain(req);
6086
if (domain == null) { parent.debug('web', 'ssh: failed checks.'); try { ws.close(); } catch (e) { } return; }
6085
- try {
6086
- require('./apprelays.js').CreateSshRelay(obj, obj.db, ws, req, obj.args, domain);
6087
- } catch (ex) { console.log(ex); }
6087
+ // If no user is logged in and we have a default user, set it now.
6088
+ if ((req.session.userid == null) && (typeof obj.args.user == 'string') && (obj.users['user/' + domain.id + '/' + obj.args.user.toLowerCase()])) { req.session.userid = 'user/' + domain.id + '/' + obj.args.user.toLowerCase(); }
6089
+ try { require('./apprelays.js').CreateSshRelay(obj, obj.db, ws, req, obj.args, domain); } catch (ex) { console.log(ex); }
6090
});
6091
obj.app.ws(url + 'sshterminalrelay.ashx', function (ws, req) {
6092
PerformWSSessionAuth(ws, req, true, function (ws1, req1, domain, user, cookie, authData) {